Block cache should always include base_url in the cache id

Because {cache_block}.cid doesn't include the base_url in the cache key, it's troublesome for sites that are accessible from multiple domains or protocols. (For example if your site is accessible via both HTTP and HTTPS).

It's also a potential security concern: in some configurations attackers can poison the block cache by forging the Host header. Images / links can be replaced with those of an attacker's choosing. (Note: this was discussed within the security team before deciding to fix publicly.)

Steps to reproduce:

(This assumes you have not explicitly set $base_url in settings.php, and that your Drupal site is the default virtual host.)

• Create a block with this PHP code:

  <img src="<?php print file_create_url('sites/default/files/test.png'); ?>" />
  

  (This is just a demo - a more realistic scenario would be a View that displays an Image Field)

• Enable block caching, set this test block to BLOCK_CACHE_GLOBAL
• Run this curl command: curl -H'Host: evil.com' example.com
• Visit example.com in your browser; you'll see the cached version of the block with evil.com as the image source. In addition to replacing the image, evil.com now has access to the victim's browsing activity via the referrer logs.

Note - the patch is for D6. Also tagging as infrastructure, this may help with #952578: Fix any references to non https resources, fix redirects to avoid double encoding url parameters